Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Dolphinscheduler
(Apache)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 14 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2022-03-30 | CVE-2022-25598 | Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher. | Dolphinscheduler | 7.5 | ||
| 2023-04-20 | CVE-2023-25601 | On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version 3.0.0 to 3.1.1, you can turn off the python-gateway function by changing the value `python-gateway.enabled=false` in configuration file `application.yaml`. If you are using the python gateway, please upgrade to version 3.1.2 or above. | Dolphinscheduler | 4.3 | ||
| 2022-11-23 | CVE-2022-45462 | Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher | Dolphinscheduler | 9.8 | ||
| 2022-10-28 | CVE-2022-26884 | Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher. | Dolphinscheduler | 6.5 |